On Fri, 3 Jan 2020, Philip Prindeville wrote:
On Jan 3, 2020, at 11:34 AM, RW <rwmailli...@googlemail.com> wrote:
On Fri, 3 Jan 2020 10:09:21 -0800 (PST)
John Hardin wrote:
On Fri, 3 Jan 2020, Pedro David Marco wrote:
header __L_RECEIVED_SPF exists:Received-SPF
tflags __L_RECEIVED_SPF multiple maxhits=20
meta L_RECEIVED_SPF (__L_RECEIVED_SPF >= 10)
describe L_RECEIVED_SPF Crazy numbers of Received-SFP headers
score L_RECEIVED_SPF 20.0
but it never seems to match.
"exists" is a boolean, it's reasonable that it only returns one hit
regardless of the number of instances present.
Try this instead, to actually match the header(s):
header __L_RECEIVED_SPF Received-SPF =~ /^./
That should be:
header __L_RECEIVED_SPF Received-SPF =~ /^./m
Seems to work either way!
The /m shouldn't be needed given the "tflags multiple". It would be needed
if you were doing it in a plain "headers ALL =~ /.../" rule that wanted to
look at multiple headers without "tflags multiple" (which is a valid
different way to do it, but the "tflags multiple" approach is easier).
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhar...@impsec.org FALaholic #11174 pgpk -a jhar...@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
Anyone who uses the word "profit" as a dirty word should be
watched very, very carefully. If they hate the idea of gain
through free trade it can only mean that they’re looking to
get it through robbery. -- Lyle@Ultimak
-----------------------------------------------------------------------
305 days until the Presidential Election
